Usekeys are a pass. Trap them!
this post was submitted on 14 Oct 2026
216 points (98.2% liked)
Linux
68083 readers
1041 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
Meanwhile, half of the people at every company I've ever worked at:
If the computer is in even a marginally secure place, storing passwords on physical paper is better than what a lot of people do.
Of all the proverbial bullets I've been hit with, none had my name on them; they were all addressed "To whom it may concern". The times my identity has been stolen or my accounts compromised it was because somebody attacked some fairly large entity, like Alphabet or Equifax or Microsoft or Visa. Nobody's going to walk into my house looking for my passwords. They might walk into my house looking for my television, but that hasn't happened to this house longer than I've been alive.
Woah now what about changing 1 to !
Holy $#!7111
Alt joke:
Thanks for the tip! My password is now....
hunter2 I feel more secure already. :D
I have a nice notepad from a conference on my desk labelled “Passwords”
The worst part of the left one is the implication they have only two passwords. The "under the keyboard" part at least requires physical access and (hopefully) means its not something stupid or short like "p@ssw0rd".
I have yet to see a sticky note password that was anywhere near NIST compliant lol.
NIST compliance is 15 characters. That's it. No stupid cycling every three months. No stupid special characters.
Somebody finally read the XKCD comic.
I wonder why passphrases fell out of style? If you remembered a series of random words like you were activating the freaking Winter Soldier, boom, 40+ characters!
my workplace makes us change passwords every 3 months and I don't respect them so its the same password with the same number at the end -1 because I can't be bothered. If I get hacked oh no ive dealt damage to a multi billion dollar corporation woe.
I have a system of using month and year plus a common trailing string. My annoyance is that every year the last number on the year keeps moving.
The biggest problem I see is that it requires OS or browser integration. While possibly a better solution than simple passwords this feels like a vendor lock-in scheme.
You could store them in your password safe if it supports them?
Potentially the server can request hardware/software attestation that would limit the choice of password safe to approved ones only. We don't yet know how big/likely this could be, but in theory it's possible.
well, if I've seen a vendor lockin before, and I've seen a couple, they'll push them with open standards until they're accepted and normalized.
Then suddenly the big players like Google and Microsoft will block all the open platforms sighting "security" forcing businesses to adopt closed proprietary versions while touting their free and easy too use platforms.
then the monitize it.
Passkeys are awesome. Developers not following the standard properly are a trap.
Passkeys are greate as long you make sure you use a third party (partial) password app, like proton or bitwarden that works everywhere.
I think the worry is that if passkey attestation is required it will force people into a narrow set of authenticators controlled by the big orgs.
At this point in time it's not a problem, but how can we know it won't be in future?
This right here. KeepassXC (PC) already had passkey support for a while, KeepassDX (Android) recently implemented support. If you use FOSS implementations, vendor lock-in and potential future corporate enshittification are non-issues.
vendor lock-in and potential future corporate enshittification are non-issues.
For now.
In some countries, banks require users use their app on IOS or Google'd Android. You can't use their services via browser, LineageOS, GrapheneOS
load more comments
(4 replies)
The argument from the "it's a trap" article is that the service you are registering to can use attestation to ensure that you are only using passkey managers that they approve.
I have to admit that I haven't investigated this thoroughly myself but if the protocol can be abused in that way then your only choice really would be not to use the service. If it is related to banking or government services then you may not have much of a choice.
The web api for fido2/passkeys exposes attestation information.
Warning: Attestation provides a way for a relying party to determine the provenance of an authenticator. Relying parties should not attempt to maintain allowlists of authenticators.
from https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API
Mozilla's warning is funny. "Don't use this to reject attestations from unapproved authenticators!" That's, like, almost the entire purpose to attestation. It tells you an Apple device or a YubiKey or whatever created the credential. What else could you use this information for other than to make life harder for users using certain authenticators?
load more comments
(1 replies)
load more comments
(2 replies)
They really aren't a trap. They're a well designed standard. The tooling around them isn't quite perfect yet, but they're a huge improvement over passwords.
People upvote because they hate change.
The trap is they're pushing passkeys before password managers that make them portable are yet to be mainstream. And that platform lock in may be a motive driving it.
"To login to your account, please use the device assigned to your identity."
Right now, if someone who doesn't know about password managers starts using passkeys because of a few popups you just have to follow through to enroll, they're going to get very confused when they try to login somewhere else. There may be alternative login methods for now, but that may change.
It doesn't seem all that forced yet, but if we have any idea of how big tech works, that's where it is going.
Passkeys are great, Big tech aren't.
I use them with my password manager but I'm cautious on which services and how often i may need to login to them on other devices.
I would say the people hate it, because they are exposed to the tooling and not the standard.
The standard might be the best there is, if the tooling is shit people won't use it. And once you've been exposed to bad tools you make the connection between tools bad = passkey bad because they don't know there's a difference...
People upvote because they hate change.
People upvote because big tech has a tendency of forcing the most anti ownership outcome possible on everyone. Here, such an outcome likely would be mandatory passkeys that are set up to require hardware attestation.
One way to reduce that risk is to boycott passkeys until TPM and hardware attestation are removed from the standard. You may not think that's a fair response, or that such a boycott won't save us from the inevitable outcome, but nevertheless it's not a completely irrational reaction.
And also until the committee designing it has it members on it representing the interests of users. The point that this was lacking in the original is-a-trap article is an important one and is also being missed.
This is what people seem to be missing, I haven't seen a rebuttal to this problem.
I'm just not convinced that mandatory hardware attestation is actually a real problem we need to worry about.
Like, yes, people with high security jobs will have that for sure. And they should.
But large companies that want customers? They want to make it as easy as possible for their customers to connect. They're not going to force people to have a hardware device which if damaged or lost will lose them a customer. That's just not what they want.
And yet, it's there.
Embrace, extend, extinguish as in literally every single corporate case. Thousands of rug pulls later and we still haven't learned our lesson.
In this case: first get people in the door en masse, then expand the requirements for things like hardware attestation in a transition period, then vendor lock people.
Adobe would never move to cloud only, that would lose them customers.
See: Literally every single API rug pull ever. Reddit, Unity, etc... Get people using the API and infrastructure, then switch from free to huge fees.
See: cloud companies giving good deals for storage and then charging massive fees for output bandwidth to access or move that data
See: VMware rug pull
This is the exact same except they are telling us what they are going to do from the start. When someone tells you how shitty they are, listen.
I only dislike the ability for service providers to enforce a “security level”. Those should be the exclusively under my (the user) control. Sending preferred default (hints) would be cool, but not enforcement.
That a webpage can basically prevent me from using a passkey if the passkey is stored in software (a password manager for example) is complete bullshit. Especially if there is still username/password as alternative which is clearly worse. Sure, hardware tokens are the ultimate security. But it should be up to me and not them if I want that level of security.
But they already do enforce a "security level" for passwords through minimum character counts (e.g. must be at least 8 characters long), specific character requirements (e.g. at least one upper case + lower case + number), rotation schedules (e.g. must be changed every 90 days), etc. Some even enforce password sharing (e.g. Netflix IP/geolocation checks).
Yeah and certain password requirements are also dumb. But at least they still give me a degree of freedom how to generate the password and how I store the password.
Second factor is sometimes worse than Passkeys; with vendor specific apps (Steam Guard, Blizzard Authenticator, Microsoft Authenticator, etc) instead of following standard TOTP. But still. I want agency over my credentials.
load more comments
(2 replies)
Admittedly I didn’t read that one guy’s blog post very closely, but it seemed to claim that because some companies may some day misuse/abuse some features of passkeys, passkeys are poison and no one should ever use them.
It's a very basic principle, that you don't create powers that could be abused. That they haven't been abused yet does not make doing so ok. It like saying it's ok that my government was given the power to lock people up with no reason or due process because they haven't used it yet.
Well if that's possible, it doesn't sound like a good basis for security.
The features they're talking about are secure from a cryptographic standpoint.
However, there are features built into the passkey system so that a company could decide that it will only accept passkeys from a specific piece of hardware or software.
This isn't necessarily bad, you may only want your server to allow you access if the passkey comes from your phone's hardware. A person could have stolen your passkey but they're unable to fake the attestation step.
On the other end of things, a company like Google could provide a passkey service which requires you to use hardware provided by vendors that they approve of and they could abuse their position to force it's implementation, such as how you can use Google to sign into websites via OIDC.
Google could just as easily provide a service for 'secure' passkeys which are only allowed to be issued by phones provided by Google, Verizon or AT&T. No more third-party OSs (at least, if you want to sign into anything on the Internet) and no more jailbroken phones. You would have to use the exact, spyware laden, operating system that comes installed directly from your cellular provider who would have remote root access to your device.
I think the idea that we can just boycott passkeys and prevent this is nonsense magical thinking. It requires some hypothetical world where we can perfectly coordinate a boycott of otherwise useful technology. In reality this issue will remain obscure and generally only known to people interested in the topic while Google can pour tens of millions in advertising to reach everybody on the planet explaining how good and secure attested passkeys are to mainstream Internet users.
Use passkeys, they're useful and more secure than passwords. Not using them won't prevent enshittification, just sit back and watch the slow motion attested passkey trainwreck as it unfolds over the next decade.
I’m gonna need to find this comment in ten years. Wish me luck
Please provide a blood sample to verify your Age. Thank you for using Open FaceGoogazonthropic, we love you.
load more comments
(4 replies)
I have a password manager and hardware token. I see no need to use passkeys.
load more comments
(11 replies)
Last time I was in Thailand and my buddy told me don't worry, she's not a trap.
view more: next ›